Merge pull request #530 from cgwalters/boot-default-fs #74
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| permissions: | |
| actions: read | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: {} | |
| env: | |
| CARGO_TERM_COLOR: always | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| tests: | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }} | |
| runs-on: ubuntu-latest | |
| container: quay.io/coreos-assembler/fcos-buildroot:testing-devel | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install deps | |
| run: ./ci/installdeps.sh | |
| - name: Mark git checkout as safe | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| # xref containers/containers-image-proxy-rs | |
| - name: Cache Dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: "tests" | |
| - name: cargo fmt (check) | |
| run: cargo fmt -- --check -l | |
| - name: Build | |
| run: cargo test --no-run | |
| - name: Build lib without default features | |
| run: cd lib && cargo check --no-default-features | |
| - name: Individual checks | |
| run: (cd cli && cargo check) && (cd lib && cargo check) | |
| - name: Lints | |
| run: cargo xtask custom-lints | |
| - name: Run tests | |
| run: cargo test -- --nocapture --quiet | |
| - name: Manpage generation | |
| run: mkdir -p target/man && cargo run --features=docgen -- man --directory target/man | |
| - name: Clippy (gate on correctness and suspicous) | |
| run: cargo clippy -- -D clippy::correctness -D clippy::suspicious | |
| build-fedora: | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }} | |
| runs-on: ubuntu-latest | |
| container: quay.io/coreos-assembler/fcos-buildroot:testing-devel | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install deps | |
| run: ./ci/installdeps.sh | |
| - name: Cache Dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: "build" | |
| - name: Build | |
| run: make test-bin-archive | |
| - name: Upload binary | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: bootc.tar.zst | |
| path: target/bootc.tar.zst | |
| build-c9s: | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }} | |
| runs-on: ubuntu-latest | |
| container: quay.io/centos/centos:stream9 | |
| steps: | |
| - run: dnf -y install git-core | |
| - uses: actions/checkout@v4 | |
| - name: Install deps | |
| run: ./ci/installdeps.sh | |
| - name: Cache Dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: "build-c9s" | |
| - name: Build | |
| run: make test-bin-archive | |
| - name: Upload binary | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: bootc-c9s.tar.zst | |
| path: target/bootc.tar.zst | |
| cargo-deny: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: EmbarkStudios/cargo-deny-action@v1 | |
| with: | |
| log-level: warn | |
| command: check bans sources licenses | |
| privtest: | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }} | |
| name: "Privileged testing" | |
| needs: build-fedora | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Download | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: bootc.tar.zst | |
| - name: Install | |
| run: sudo tar -C / -xvf bootc.tar.zst | |
| - name: Integration tests | |
| run: sudo podman run --rm --privileged -v /run/systemd:/run/systemd -v /:/run/host -v /usr/bin/bootc:/usr/bin/bootc --pid=host quay.io/fedora/fedora-coreos:testing-devel bootc internal-tests run-privileged-integration | |
| container-tests: | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }} | |
| name: "Container testing" | |
| needs: build-fedora | |
| runs-on: ubuntu-latest | |
| container: quay.io/centos-bootc/fedora-bootc:eln-1708320930 | |
| steps: | |
| - name: Download | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: bootc.tar.zst | |
| - name: Install | |
| run: sudo tar -C / -xvf bootc.tar.zst | |
| - name: Integration tests | |
| run: bootc internal-tests run-container-integration | |
| privtest-alongside: | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }} | |
| name: "Test install-alongside" | |
| needs: [build-c9s] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Ensure host skopeo is disabled | |
| run: sudo rm -f /bin/skopeo /usr/bin/skopeo | |
| - name: Download | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: bootc-c9s.tar.zst | |
| - name: Install | |
| run: tar -xvf bootc.tar.zst | |
| - name: Integration tests | |
| run: | | |
| set -xeuo pipefail | |
| image=quay.io/centos-bootc/centos-bootc-dev:stream9 | |
| echo 'ssh-ed25519 ABC0123 [email protected]' > test_authorized_keys | |
| sudo podman run --rm --privileged -v ./test_authorized_keys:/test_authorized_keys --env RUST_LOG=debug -v /:/target -v /var/lib/containers:/var/lib/containers -v ./usr/bin/bootc:/usr/bin/bootc --pid=host --security-opt label=disable \ | |
| ${image} bootc install to-filesystem --acknowledge-destructive \ | |
| --karg=foo=bar --disable-selinux --replace=alongside --root-ssh-authorized-keys=/test_authorized_keys /target | |
| ls -al /boot/loader/ | |
| sudo grep foo=bar /boot/loader/entries/*.conf | |
| grep authorized_keys /ostree/deploy/default/deploy/*/etc/tmpfiles.d/bootc-root-ssh.conf | |
| # TODO fix https://github.com/containers/bootc/pull/137 | |
| sudo chattr -i /ostree/deploy/default/deploy/* | |
| sudo rm /ostree/deploy/default -rf | |
| sudo podman run --rm --privileged --env RUST_LOG=debug -v /:/target -v /var/lib/containers:/var/lib/containers -v ./usr/bin/bootc:/usr/bin/bootc --pid=host --security-opt label=disable \ | |
| ${image} bootc install to-existing-root --acknowledge-destructive | |
| sudo podman run --rm --privileged -v /:/target -v ./usr/bin/bootc:/usr/bin/bootc --pid=host --security-opt label=disable ${image} bootc internal-tests verify-selinux /target/ostree --warn | |
| install-to-existing-root: | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }} | |
| name: "Test install-to-existing-root" | |
| needs: [build-c9s] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Download | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: bootc-c9s.tar.zst | |
| - name: Install | |
| run: tar -xvf bootc.tar.zst | |
| - name: Integration tests | |
| run: | | |
| set -xeuo pipefail | |
| # We should be able to install to-existing-root with no install config, | |
| # so we bind mount an empty directory over /usr/lib/bootc/install. | |
| empty=$(mktemp -d) | |
| image=quay.io/centos-bootc/centos-bootc-dev:stream9 | |
| sudo podman run --rm --privileged --env RUST_LOG=debug -v /:/target -v /var/lib/containers:/var/lib/containers -v ./usr/bin/bootc:/usr/bin/bootc -v ${empty}:/usr/lib/bootc/install --pid=host --security-opt label=disable \ | |
| ${image} bootc install to-existing-root | |
| install-to-loopback: | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'control/skip-ci') }} | |
| name: "Test install to-disk --via-loopback" | |
| needs: [build-c9s] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Download | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: bootc-c9s.tar.zst | |
| - name: Install | |
| run: tar -xvf bootc.tar.zst | |
| - name: Integration tests | |
| run: | | |
| set -xeuo pipefail | |
| image=quay.io/centos-bootc/centos-bootc-dev:stream9 | |
| tmpdisk=$(mktemp -p /var/tmp) | |
| truncate -s 20G ${tmpdisk} | |
| sudo podman run --rm --privileged --env RUST_LOG=debug -v /dev:/dev -v /:/target -v /var/lib/containers:/var/lib/containers -v ./usr/bin/bootc:/usr/bin/bootc --pid=host --security-opt label=disable \ | |
| -v ${tmpdisk}:/disk ${image} bootc install to-disk --via-loopback /disk | |
| docs: | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'documentation') }} | |
| runs-on: ubuntu-latest | |
| env: | |
| MDBOOK_VERSION: 0.4.37 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install mdBook | |
| run: | | |
| tag=$(curl 'https://api.github.com/repos/rust-lang/mdbook/releases/latest' | jq -r '.tag_name') | |
| url="https://github.com/rust-lang/mdbook/releases/download/${tag}/mdbook-${tag}-x86_64-unknown-linux-gnu.tar.gz" | |
| mkdir mdbook | |
| curl -sSL $url | tar -xz --directory=./mdbook | |
| echo `pwd`/mdbook >> $GITHUB_PATH | |
| - name: Install mdbook-mermaid | |
| run: | | |
| tag=$(curl 'https://api.github.com/repos/badboy/mdbook-mermaid/releases/latest' | jq -r '.tag_name') | |
| url="https://github.com/badboy/mdbook-mermaid/releases/download/${tag}/mdbook-mermaid-${tag}-x86_64-unknown-linux-gnu.tar.gz" | |
| mkdir mdbook-mermaid | |
| curl -sSL $url | tar -xz --directory=./mdbook-mermaid | |
| echo `pwd`/mdbook-mermaid >> $GITHUB_PATH | |
| - name: Install mdbook-linkcheck | |
| run: | | |
| tag=$(curl 'https://api.github.com/repos/Michael-F-Bryan/mdbook-linkcheck/releases/latest' | jq -r '.tag_name') | |
| archive="mdbook-linkcheck.x86_64-unknown-linux-gnu.zip" | |
| url="https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases/download/${tag}/${archive}" | |
| mkdir mdbook-linkcheck | |
| curl -sSL -O $url && unzip ${archive} -d ./mdbook-linkcheck && chmod +x ./mdbook-linkcheck/mdbook-linkcheck | |
| echo `pwd`/mdbook-linkcheck >> $GITHUB_PATH | |
| - name: Build with mdBook | |
| run: cd docs && mdbook-mermaid install && mdbook build |